Correspondence Ramtin Aryan, Department of Technology Systems, University of Oslo, Oslo, Norway. Email: Ramtina@ifi.uio.no Summary As the policies of a software-defined networking (SDN) network can be updated dynamically and often at a high pace, conflicts between policies can easily occur. Due to the large number of switches and heterogeneous policies within a typical SDN network, detecting those conflicts is a laborious and challenging task. This article presents three main contributions. First, we devise an offline method for detecting unmatched OpenFlow rules, that is, rules that are never fired. In our taxonomy such anomalies can stem from either invalid or irrelevant unmatched rules. Second, we introduce a new set of definitions for the intraanomalies between rules in the same table, which might occur when using the multiaction feature of an OpenFlow rule. Third, our detection method has been enhanced to support parallel execution, which makes it a viable solution for troubleshooting large-scale networks. We provide some comprehensive experimental results based on both synthetic and real-life setup the synthetic set up is designed in such a way that the rule matching takes place in the last rules of the switch and thus putting more stress on the rule detection process. The parallel method is shown to outperform the single-threaded checking method by order of magnitude up to 21.

中文翻译：

---

一种基于一般形式的 OpenFlow 规则异常检测并行方法

通讯员 Ramtin Aryan，挪威奥斯陆奥斯陆大学技术系统系。电子邮件：Ramtina@ifi.uio.no 摘要 由于软件定义网络 (SDN) 网络的策略可以动态更新且经常高速更新，因此很容易发生策略之间的冲突。由于典型 SDN 网络中存在大量交换机和异构策略，检测这些冲突是一项艰巨且具有挑战性的任务。本文介绍了三个主要贡献。首先，我们设计了一种离线方法来检测不匹配的 OpenFlow 规则，即永远不会触发的规则。在我们的分类法中，此类异常可能源于无效或不相关的不匹配规则。其次，我们为同一张表中的规则之间的内部异常引入了一组新的定义，使用 OpenFlow 规则的多操作功能时可能会发生这种情况。第三，我们的检测方法已得到增强以支持并行执行，这使其成为解决大规模网络故障的可行解决方案。我们提供了一些基于合成和现实设置的综合实验结果，合成设置的设计方式是规则匹配发生在交换机的最后一个规则中，从而对规则检测过程施加更多压力。并行方法的性能比单线程检查方法高出 21 个数量级。我们提供了一些基于合成和现实设置的综合实验结果，合成设置的设计方式是规则匹配发生在交换机的最后一个规则中，从而对规则检测过程施加更多压力。并行方法的性能比单线程检查方法高出 21 个数量级。我们提供了一些基于合成和现实设置的综合实验结果，合成设置的设计方式是规则匹配发生在交换机的最后一个规则中，从而对规则检测过程施加更多压力。并行方法的性能比单线程检查方法高出 21 个数量级。